NATIONAL RECONNAISSANCE OFFICE 

14675 Lee Road 
Chantilly, VA 20151-1715 


09 November 2016 


Mr. Benj amin Good 
American Civil Liberties Union 
125 Broad Street-18 ch Floor 
New York, NY 10004 
bgood@aclu.org 

REF: FOIA Case F-2016-00042 


Dear Mr. Good: 

This letter responds to your request dated 3 March 2016, received in 
the National Reconnaissance Office (NRO) on 8 March 2016. Pursuant to the 
Freedom of Information Act (FOIA), you requested the following: 

(1) policies, standards, and guidance related to prepublication review; 

(2) final legal analyses of past, present, or proposed prepublication-review 
requirements; 

(3) final decisions of officials conducting prepublication reviews; 

(4) correspondence with former agency employees (or their representatives) who 
have submitted materials for prepublication review since January 1, 2009; 

(5) statistics relating to prepublication review, including but not limited to 
information documenting the total numbers of individuals who have 
submitted works for review, the total number of works submitted for review, 
the total number of submissions approved without change, the total number 
of submissions returned with proposed redactions or other modifications, the 
total number of pending submissions, and the duration of prepublication 
review processes. 

(6) titles, subject matters, and dates of works submitted for prepublication 
review; and 

(7) information about enforcement proceedings instituted or contemplated on the 
basis of violations of prepublication-review requirements, 

including breach-of-contract actions, agency administrative proceedings, 
and civil or criminal litigation. 


To the extent it meets FOIA procedural requirements, your request is 
being processed in accordance with the FOIA, 5 U.S.C. § 552, as amended. 

This is a second.interim release in which we are providing one 
additional document (13 pages) responsive to item # (1) in your request, for 
"policies, standards and guidance related to prepublication review...." This 
document is being released to you in part. 

Material redacted is denied pursuant to FOIA exemption (b)(3), which 
is the basis for withholding information exempt from disclosure by statute. 



The relevant statutes are: 10 U.S.C. § 424, which provides (except as 
required by the President or for information provided to Congress), that no 
provision of law shall be construed to require the disclosure of the 
organization or any function of the NRO; the number of persons employed by 
or assigned or detailed to the NRO; or the name or official title, 
occupational series, grade, or salary of any such person; and 50 U.S.C. 

3507, as amended, which provides that the Director of National Intelligence 
"shall be responsible for protecting intelligence sources or methods," and 
exempts CIA from "any other law which require[s] the publication or 
disclosure of the organization, functions, names, official titles, salaries, 
or numbers of personnel employed by the Agency." 

We have located material responsive to item # (6) of your request, for 
"titles, subject matters, and dates of works submitted for prepublication 
review." That material has been forwarded to other agencies for review and 
treatment of their equities. Upon return to us, we will provide our final 
response to you. 

If you have any questions, please contact trial attorney Ryan Parker 
at the Federal Programs Branch of the U.S. Department of Justice, Civil 
Division at {202)514-4336 or via email at ryan.parker@usdoj.gov, and please 
reference NRO case number F-2016-00042. 


Sincerely, 



Patricia B. Cameresi 
FOIA Public Liaison 
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SECTION I - INTRODUCTION 


In accordance with the National Reconnaissance Office (NRO) 
Governance Plan, NRO Business Function (NBF) 50, Information 
Technology, Information Assurance, and Information Management (IT-IA- 
IM) and NRO Directive 56-2, this NRO Instruction (NI) sets forth the 
procedural implementation guidance and provides applicable information 
to perform the Prepublication Review process. All NRO personnel who 
perform tasks or have duties specific to Prepublication Review will 
comply with this NI. When the work to be performed under an NRO 
contract must comply with this NI, the program office shall list this 
NI as a reference document in the contract statement of work. 

SECTION II - NBF 50 PREPUBLICATION REVIEW SUB-PROCESS DOCUMENTATION 

The sub-sections that follow detail the Prepublication Review 
processing sub-process. 

Governing NBF 

NBF 50, IT-IA-IM 

Description 

The Chief Information Officer (CIO) administers the process 
for approval for public release of any unclassified information 
(including hard copy, electronic, or verbal) about, or affecting the 
plans, policies, programs, or operations of the NRO, the Intelligence 
Community (IC), or the United States Government. This NI provides 
guidance on when a prepublication review is required and explains the 
steps that all individuals and components involved in the process must 
complete. This NI does not apply to the public release of NRO logos 
or memorabilia. The Office of Security and Counterintelligence 
(OS&CI) administers a separate process for review and release of logos 
and memorabilia. 

Instruction Point of Contact 


Chief, Information Access and Review Team, 
Management Services Office (IMSO), CIO, Secure 


Information 

(b)(3) 10 USC 1 424 


Support Systems 


IMSO Website - contains additional information in support 
of the Prepublication Review process. 

Prepublication Review Submission System - Enterprise 
database used by submitters with NRO Management Information System 
access to request Prepublication Review of unclassified information 
proposed for public release. 

Tracking Information and Enterprise Response (TIER) - 
Enterprise action tracker used to administer Prepublication Review 
cases, to include dissemination of information for review, receipt of 
4 
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review responses, and case tracking/record-keeping; and used by 
component for subtasking within components. 

Process Narrative 

Unclassified materials proposed for public release must 
have the approval of a Program Security Officer (PSO) and the 
component supervisory chain prior to sending any materials to the CIO. 
If NRO contract information or information derived from an NRO 
contract is included in the material submitted for prepublication 
review, approval must also be obtained from the Contracting Officer 
(CO). The CIO will not begin the Prepublication Review process 
without the required originating component approvals. 

A minimum of 20 working days is required for the 
Prepublication Review process. Submissions that require consultation 
with external agencies will require additional time. In the event 
that the CIO is not allowed sufficient time to complete the review 
process, the CIO will issue a nonconcur determination until such time 
as the review process can be completed. 

1.0 Submitter prepares document for public release 
and collects necessary approvals. 

1.1 The PSO reviews for classified or 
unclassified sensitive information relating to the submitting office's 
programs and operations; ensures that the proposed use is a public 
release; and assists the submitter in resolution of any issues 
identified in the PSO review. 

1.2 The submitter's supervisor and Program 
Manager (may be the same individual) certify that they are aware of 
the proposed public release and approve the submission to the CIO for 
further processing. This step is not required for resumes. 

1.3 If the materials proposed for public 
release are related to an NRO contract, the cognizant CO reviews the 
submission and certifies that the release does not violate the NRO 
Acquisition Manual terms regarding public release of contract-related 
information. 


2.0 Author submits the final draft of the 
unclassified materials proposed for public release along with your 
component approvals to the CIO to begin the prepublication review 
process a full 20 working days before the due date. 

3.0 Materials must be resubmitted for review if any 
changes are made to the drafts after submission other than editorial, 
grammatical, or those recommended by CIO. 

4.0 Contact the CIO immediately if unusual 
circumstances prevent drafts from being submitted in time to meet 
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submission deadlines- CIO will not expedite non-official 
publications. 


5.0 Upon receipt of the unclassified materials for 
Prepublication Review and the required component approvals, the CIO 
will analyze the submission and task the appropriate directorates 
and/or offices to review the materials. OS&CI/Policy, Office of 
Strategic Communicati ons (Public Affairs), and A dvanced Systems & 


Technology Directorate 


submissions other than resumes. 


will review all 

(b)(3) 10 USC 1 424 


5.1 Components tasked with review will 
administer the review process within the individual components, 
utilizing cognizant PSOs and/or subject matter experts. The review 
process is determined by the individual components. 

5.2 Components compile and consolidate 
component-internal review findings into a single component-level 
response to the CIO and respond to the TIER action on behalf of the 
reviewing component. The component TIER response must include a clear 
statement of concurrence, nonconcurrence, or concurrence with comment. 
In the event of a nonconcurrence, the component response must include 
a clear explanation as to the reasons for the nonconcurrence and, if 
possible, a recommendation for change that would be acceptable. 

6.0 Upon completion of NRO component reviews, the CIO 
will make a determination regarding the necessity for review by other 
agencies. 


6.1 For official NRO releases, the CIO will 
consult with other agencies as appropriate as part of this process. 
Additional time is needed for external consultation. If external 
consultation is required for an official NRO release, the CIO will not 
issue a final release determination until consultation responses are 
received in the CIO. 


6.2 For non-NRO releases, the CIO does not 
administer external consultations as part of this process, but will 
advise the submitter in this regard as part of the final review 
determination response. 

7.0 After all component and external reviews are 
complete, the CIO will respond to the submitter with a release 
determination, to include guidance on the conditions under which the 
materials may be released to the public, a detailed accounting of any 
revisions that must be made before public release, or approval for the 
release of the materials as submitted. 

8.0 The submitting office has sole responsibility for 
maintaining a copy of the approval to release the information. It 
should be kept with the submission and maintained in accordance with 
the NRO Record Control Schedule. 
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Process Flow Diagram 



Figure is UNCLASSIFIED 
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Table 1: Risk & Internal Control Table 


Risk 

Internal Control 

Inadvertent release of information 
not appropriate for the public. 

All unclassified materials proposed 
for release to the public must be 
submitted to the PSO and component 
supervisory chain for approval prior 
to materials being sent to CIO. 

CIO tasks appropriate Directorates 
and Offices to review the material. 

CIO determines if Department of 

Defense or the IC needs to review the 
material prior to release. 

Documented agreement with IC 
counterparts to assist in reviewing 
equities. 


Table is UNCLASSIFIED 


SECTION III - CONFIGURATION CONTROL 

All changes to the IT-IA-IM, Prepublication Review Instruction 
require NBF owner approval. 

APPROVING SIGNATURE 

As the NBF owner for IT-IA-IM, I confirm that this document 
provides a complete representation of the Prepublication Review 
Instruction, and that the document has been coordinated with 
stakeholders of the process. 



IT-IA-IM NBF Owner 


% f&fa * 201.3 

Date 
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APPENDIX A - PROCESS FLOW DIAGRAM LEGEND 
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APPENDIX B - GLOSSARY 


Term 

^ II 14IM .-..I-:.,, . L-'i 

Agency 

Any executive or military department, other 
establishment, or entity included in the definition of 
agency in 5 U.S.C. § 522(f). 

Business 

Information 

Technology 

Information Technology (IT) activities associated with 
the development and maintenance of software and 
hardware to support business functions to include, but 
not limited to, human capital, core financials, 
acquisition, procurement, logistics, grants, asset 
management, payroll, budget formulation and execution, 
performance management, travel, time and attendance, 
cost accounting, project accounting, earned value 
management, personnel management applications, and 
elements of security systems that track personnel. 


Business Information Technology (BIT) also includes 
all supporting feeder systems that support the 

Business Management operations of an organization or 
agency. BIT applications and services shall be 
available to business systems users via Enterprise 
Information Technology (EIT) networks and 
workstations. 

Component 

Any individual NRO D or 0 that participates in the 
Prepublication Review process. 

Enterprise 

Information 

Technology 

Encompasses Information Technology (IT) activities 
associated with the Agency's infrastructure, such as 
desktops, local area networks, wide area networks, 
processors, software, security, operations, help 
desks, applications, support services, and resources 
associated with the IT. This category identifies IT 
elements and applications available to all users of 
the enterprise (e.g., e-mail). Information assurance 
(IA) capabilities are to be included in this 
category. Also included in the Enterprise Information 
Technology (EIT) category are completely installed 
computer systems and their peripheral components. 
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Information 

Technology 

Any equipment or interconnected system or subsystem of 
equipment, that is used in the automatic acquisition, 
storage, manipulation, management, movement, control, 
display, switching, interchange, transmission, or 
reception of data or information. Equipment is used 
directly or is used by a contractor under a contract 
which requires the use of such equipment, or requires 
the use, to a significant extent, of such equipment in 
the performance of a service or the furnishing of a 
product. Information Technology (IT) includes 
computers, ancillary equipment, software, firmware and 
similar procedures, services (including support 
services), and related resources. It is further 
delineated by Business Information Technology (BIT), 
Enterprise Information Technology (EIT), and Mission 
Information Technology (MIT). 

Mission 

Information 

Technology 

Information Technology (IT) activities associated with 
collection, analysis, and production systems, and 
information sharing/collaboration tools, applications, 
and software, with the exception of office automation 
systems. 


These systems can exist at the point where information 
is initially processed or at the point where analysts 
turn collected information into intelligence and 
knowledge. Mission Information Technology (MIT) also 
includes special purpose software and IT elements used 
among small, unique user populations. 

Non-NRO 

Release 

A record or document that will be released not on the 
behalf of the NRO (for example, private party 
documents, contractor produced documents not produced 
for the NRO). 

Official 

Release 

A record or document that will be released by the NRO 
or an NRO component as part of its mission and 
function 

Prepublication 

Review 

The process established to control and monitor the 
release of unclassified information about, or 
affecting the plans, policies, programs, or operations 
of the NRO, the Intelligence Community or U.S. 

Government. 

Submitter 

The individual who created the document at issue. 

Working Days 

Days when the NRO is operating (specifically excludes 
Saturdays, Sundays, and legal public holidays). 

Table is UNCLASSIFIED 
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APPENDIX B - ACRONYM LIST 


Term | Definition 


BIT 

Business Information Technology 

CIO 

Chief Information Officer 

CO 

Contracting Officer 

EIT 

Enterprise Information Technology 

IC 

Intelligence Community 

IMSO 

Information Management Services Office 

IT 

Information Technology 

IT-IA-IM 

Information Technology, Information Assurance, 
Information Management 

MIT 

Mission Information Technology 

NBF 

NRO Business Function 

NI 

NRO Instruction 

NRO 

National Reconnaissance Office 

OS&CI 

Office of Security and Counter-Intelligence 

PSO 

Program Security Officer 

TIER 

Tracking Information and Enterprise Response 


Table is UNCLASSIFIED 
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APPENDIX C - REFERENCES/AUTHORITIES 

a. 50 United States Code, Chapter 15, National Security Act of 

1947 

b. Executive Order 12333, United States Intelligence Activities, 
as amended 

c. Executive Order 13526, Classified National Security 
Information, 29 Dec 09 

d. Department of Defense Instruction 5230.29, Security and 
Policy Review of Department of Defense Information for Public Release, 
8 Jan 09 


e. Department of Defense Regulation 5230.9, Clearance of 
Information for Public Release, 9 Apr 96 (b)(3) 50 USC 1 3507 


f. Agency Regulation 


Agency Prepublication Review of 


Certain Material Prepared for Public Dissemination, 30 May 07 


g. Agency Regulation Policy and Procedures for the Release 

of Unclassified Agency Official Information to the Public, 19 Sep 95 


h. National Reconnaissance Office Acquisition Manual 

i. National Reconnaissance Office Business Function 50, 
Information Technology, Information Assurance, and Information 
Management 


j. National Reconnaissance Office Directive 56-2, Access and 
Release 
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